July 2022 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1193873] New: VUL-0: CVE-2020-36428: matio: heap-based buffer overflow in ReadInt32DataDouble
by bugzilla_noreply＠suse.com 08 Dec '22

08 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1193873 Bug ID: 1193873 Summary: VUL-0: CVE-2020-36428: matio: heap-based buffer overflow in ReadInt32DataDouble Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/304604/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: badshah400(a)gmail.com Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- matio (aka MAT File I/O Library) 1.5.18 through 1.5.21 has a heap-based buffer overflow in ReadInt32DataDouble (called from ReadInt32Data and Mat_VarRead4). References: https://bugzilla.redhat.com/show_bug.cgi?id=1985239 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36428 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21421 https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2020-799… http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36428 http://www.cvedetails.com/cve/CVE-2020-36428/ -- You are receiving this mail because: You are on the CC list for the bug.

1 4

[Bug 1193874] New: VUL-0: CVE-2021-36977: matio: heap-based buffer overflow in H5MM_memcpy()
by bugzilla_noreply＠suse.com 08 Dec '22

08 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1193874 Bug ID: 1193874 Summary: VUL-0: CVE-2021-36977: matio: heap-based buffer overflow in H5MM_memcpy() Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.3 Hardware: Other URL: https://smash.suse.de/issue/304598/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: badshah400(a)gmail.com Reporter: gabriele.sonnu(a)suse.com QA Contact: security-team(a)suse.de Found By: Security Response Team Blocker: --- matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based buffer overflow in H5MM_memcpy (called from H5MM_malloc and H5C_load_entry). References: https://bugzilla.redhat.com/show_bug.cgi?id=1984613 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-36977 https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=31265 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36977 https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2021-440… -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1173926] New: osc lbl terrible slow
by bugzilla_noreply＠suse.com 07 Dec '22

07 Dec '22

https://bugzilla.suse.com/show_bug.cgi?id=1173926 Bug ID: 1173926 Summary: osc lbl terrible slow Classification: Internal Novell Products Product: openSUSE Build Service Version: master Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: osc Assignee: adrian.schroeter(a)suse.com Reporter: marco.strigl(a)suse.com QA Contact: adrian.schroeter(a)suse.com Found By: --- Blocker: --- With big build logs, doing osc lbl takes a long time: $ time isc lbl > /dev/null real 0m34.623s user 0m34.507s sys 0m0.069s $ time cat /var/tmp/build-root/standard-x86_64/.build.log > /dev/null real 0m0.315s user 0m0.001s sys 0m0.079s -- You are receiving this mail because: You are on the CC list for the bug.

1 9

[Bug 1160446] New: osc (or obs) creates wrong submit request
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1160446 Bug ID: 1160446 Summary: osc (or obs) creates wrong submit request Classification: Internal Novell Products Product: openSUSE Build Service Version: master Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: osc Assignee: adrian(a)suse.com Reporter: snwint(a)suse.com QA Contact: adrian(a)suse.com Found By: --- Blocker: --- 'osc sr -r N ...' does not work correctly (specifying a release). Compare # osc sr -r 1227 openSUSE.org:system:install:head installation-images SUSE:SLE-15-SP1:Update https://build.suse.de/request/show/208898 (wrong) with (copying revision 1227 to another project and submitting that) https://build.suse.de/request/show/208900 (ok) The bad part is that osc in both cases shows the same diff - see the build.suse.de pages but the actual submission is different - see the changelog diff. Despite '-r' the latest version is submitted. -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1156501] New: Regression: can not use OSC without kwallet
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1156501 Bug ID: 1156501 Summary: Regression: can not use OSC without kwallet Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: All OS: openSUSE Factory Status: NEW Keywords: dogfood Severity: Critical Priority: P5 - None Component: Basesystem Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: werner(a)suse.com QA Contact: qa-bugs(a)suse.de CC: fabian(a)ritter-vogt.de, tchvatal(a)suse.com Found By: --- Blocker: --- Latest Tumbleweed cause that osc triggers the start of kwalletd5 and this leads to an error | Error when attempting to decrypt the wallet kdewallet using GPG. If you're | using a SmartCard, please ensure it's inserted then try again. | | GPG error was Inappropriate ioctl for device That is I can not set my passphrase anymore. I'm not using KDE, I'm a fvwm2+lsxession user. Without passphrase I can not work on my Tumblweed workstation anymore hence this is critical -- You are receiving this mail because: You are on the CC list for the bug.

2 34

[Bug 1155953] New: osc v0.166 broke my osc vc use case
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1155953 Bug ID: 1155953 Summary: osc v0.166 broke my osc vc use case Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: brogers(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- I use the following: osc vc --file=$package.changes.proposed $package where $package is in this case qemu or qemu-linux-user (see qemu package sources if you want context, in particular the update_git.sh script. In this specific instance, I working on this IBS project/package: https://build.suse.de/package/show/home:bfrogers:branches:Devel:Virt:SLE-15…) The file passed has content I want automatically added to qemu.changes or qemu-linux-user.changes. This command no longer works as before, instead I am left with a new file: $package.changes.proposed.changes, which is wrong. -- You are receiving this mail because: You are on the CC list for the bug.

2 8

[Bug 1154972] New: release osc 0.166.0^
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1154972 Bug ID: 1154972 Summary: release osc 0.166.0^ Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: marco.strigl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- New version of osc for the following distributions: openSUSE Tumbleweed openSUSE Leap 15.1 SLES 15 SLES 15.1 0.166.0 - New password handling backend. Supported password stores: * Plaintext password * Obfuscated password * python-keyring (kwallet, secret store) * gnome-keyring * no store at all (ask for the password every time - Refactor initial setup of osc (to select password store) - fix decoding on osc lbl (boo#1137477) - fix breakage of submitting complete branches back as an submit request that contain packages without a change. - fix error with plugins and osc -h - various decoding improvements - Transfer the name of the input file to vc instead of the content (obs-build/vc will do the rest and open the file). - support appimage builds - new command browse. (opens a browser opening the project or package) - new option --incoming for osc rq and osc review to only show only incoming reqeusts for a project. -- You are receiving this mail because: You are on the CC list for the bug.

2 6

[Bug 1144211] New: [TRACKERBUG] update osc to version 0.165.3
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1144211 Bug ID: 1144211 Summary: [TRACKERBUG] update osc to version 0.165.3 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: marco.strigl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- 0.165.4 - allow optional fork when creating a maintenance request - fix RPMError fallback - fix local caching for all package formats - fix appname for trusted cert store - osc -h does not break anymore when using plugins -- You are receiving this mail because: You are on the CC list for the bug.

2 11

[Bug 1142662] New: [TRACKERBUG] update osc to version 0.165.3
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1142662 Bug ID: 1142662 Summary: [TRACKERBUG] update osc to version 0.165.3 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: marco.strigl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- important fixes: - fixed broken TLS certificate handling (boo#1142518, CVE-2019-3685) - switch to difflib.diff_bytes and sys.stdout.buffer.write for diffing old behavior results in non working osc diff, ci and rq on packages -- You are receiving this mail because: You are on the CC list for the bug.

2 10

[Bug 1140697] New: [TRACKERBUG] update osc to version 0.165.2
by bugzilla_noreply＠novell.com 07 Dec '22

07 Dec '22

http://bugzilla.suse.com/show_bug.cgi?id=1140697 Bug ID: 1140697 Summary: [TRACKERBUG] update osc to version 0.165.2 Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.1 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: bnc-team-screening(a)forge.provo.novell.com Reporter: marco.strigl(a)suse.com QA Contact: qa-bugs(a)suse.de Found By: --- Blocker: --- This is a trackerbug for the version update of osc to version 0.165.2 -- You are receiving this mail because: You are on the CC list for the bug.

2 11